Access control

Hi,

One more PR about simplifying Security doc: several paragraphs were redundant, such as "Securing a controller", "Access Control in a Controller"...
I factored all relative sections in a part called "Access Control", logically coming after "Users" and "Roles" parts.

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | 2.3+
| Fixed tickets | none